SharePoint JWT bypass went from proof of concept to exploitation in under 48 hours

Attackers began exploiting CVE-2026-55040 after Rapid7 released a Python proof of concept in the week of August 13, 2026. The flaw (CVSS 9.1) chains four weaknesses across two SharePoint JWT token handler classes into an unauthenticated bypass that lets an attacker act as any site user or administrator. KEVIntel recorded a dozen attempts from eight IP addresses in Hong Kong, Japan, the Netherlands, Taiwan and the United States, with the first on July 19 and a spike of eight on August 12 and 13. Microsoft patched it in the July 2026 update cycle. It is the fifth SharePoint flaw exploited in 2026, and we covered the original disclosure on July 14.

Why it matters

The number worth writing down is the interval: PoC published, mass scanning inside two days, against a patch that had been available for a month. If your remediation SLA for internet-facing identity surfaces is measured in weeks, the exploit is already there when you arrive.

The technical half is a repeat. CVE-2023-29357 was the same product accepting alg:none and skipping signature verification. Three years on, four separate validation weaknesses in two handler classes compose into the same outcome, which is the signature of JWT validation spread across code paths that each assume another one checked. Consolidate verification into one place that checks signature, issuer, audience and expiry together, and never lets the token choose its algorithm. See the validate a JWT recipe. For detection, a forged token leaves a specific trace: authenticated SharePoint activity with no preceding sign-in event.

Source: The Hacker News